package accesscontrol

import (
	"context"

	"github.com/Tencent/WeKnora/internal/accesspolicy"
	"github.com/Tencent/WeKnora/internal/types"
)

func (s *Service) populatePersonalAccess(ctx context.Context, snapshot *accesspolicy.Snapshot) error {
	t, u := identity(ctx)
	snapshot.Hidden = map[string]bool{}
	snapshot.NoExport = map[string]bool{}
	if !administrator(ctx) {
		var rows []ResourceHidden
		if err := s.db.WithContext(ctx).Where("tenant_id=? AND owner_id=?", t, u).Find(&rows).Error; err != nil {
			return err
		}
		for _, row := range rows {
			snapshot.Hidden[row.Kind+":"+row.ResourceID] = true
		}
		humanIDs := []string{}
		for _, row := range rows {
			if row.Kind == "digital-humans" {
				humanIDs = append(humanIDs, row.ResourceID)
			}
		}
		if len(humanIDs) > 0 {
			var humans []types.DigitalHuman
			if err := s.db.WithContext(ctx).Select("primary_agent_id").Where("tenant_id=? AND id IN ?", t, humanIDs).Find(&humans).Error; err != nil {
				return err
			}
			for _, human := range humans {
				if human.PrimaryAgentID != "" {
					snapshot.Hidden["agents:"+human.PrimaryAgentID] = true
				}
			}
		}
	}
	var forks []ResourceFork
	if err := s.db.WithContext(ctx).Where("tenant_id=? AND no_export=true", t).Find(&forks).Error; err != nil {
		return err
	}
	for _, row := range forks {
		snapshot.NoExport[row.Kind+":"+row.PersonalID] = true
	}
	return nil
}